Privacy Policy

Draft update: 23 September 2026, pending Build 22 release. Contact: doublerookstudio@gmail.com.

Your membership cards

CardPadu saves card names, membership numbers, barcode/QR values, notes, favourites and card images on your device. Card images are stored privately with encryption. The core wallet remains available without an account and CardPadu does not silently upload or continuously sync this collection. If you explicitly choose Backup All Cards after signing in with Google, CardPadu creates a versioned wallet snapshot and uploads it to CardPadu's private application-data area in your Google Drive. Temporary Share records, received cards, share links/tokens, account/session tokens and analytics identifiers are excluded from that backup.

Optional account and profile photo

Google or Email sign-in is optional and begins only from Profile. Profile may display your account email and verification status. A profile photo chosen from camera or gallery is decoded and re-encoded before local storage or backup so source EXIF and location metadata are not retained. Profile email and photo are not shown in Temporary Share. Google Drive access requests only the private app-data scope; an expired Google provider token requires reconnection.

Temporary Share

When you choose Temporary Share, CardPadu uploads only the generated card display needed for the recipient page. A random link remains valid for up to 30 minutes unless revoked earlier. The recipient page may show a small CardPadu promotion and verified Google Play link below the card. The Build 22 candidate separates created, recipient opens, first recipient open, owner preview, revoked, expired, bounded failures, estimated short-lived anonymous browser sessions and Play CTA stages. These measurements do not include card content, the public share token, email, GPS/location, raw IP identity or a permanent browser fingerprint. Do not share the link with anyone who should not see the temporary card.

Camera and images

Camera access is used when you choose to scan a code or photograph a card. Images selected from your gallery or camera are used to create your local card collection and detect supported codes. You may decline camera permission and enter a card manually.

My QR and Smart Capture in the next patch

My QR will store your own receive QR image on this phone. CardPadu will not process or verify payments. Smart Capture will propose a crop and card details for your review; card images and recognized text are not sent to product analytics. Availability and offline operation remain subject to device testing.

Optional product analytics in the next patch

Product analytics will be off by default. If you opt in, CardPadu will send a random installation ID, bounded feature events, app version and original event times. Events may wait in a limited encrypted local queue while offline. Temporary Share attribution keeps Play CTA, attributed install, first open and first useful activation as different stages. Premium conversion remains unavailable until a server-verified billing entitlement exists. No card number, QR content or image, OCR text, share token, email, payment information or location is included. You can turn analytics off in the app; the local queue and installation ID are then removed. Server event and share metric retention is planned for 180 days, subject to deployment review.

Google advertising

The current testing version includes Google Mobile Ads. Google's advertising and consent services may process IP addresses, device identifiers, app/ad interactions and diagnostics for delivery, measurement, fraud prevention and service operation. Card names, numbers, notes and photos are not supplied as ad targeting data by CardPadu.

Retention and deletion

Cards and images remain on your device until you delete them or remove the app's data. Uninstalling or clearing app data removes the local collection unless you previously made and can access a valid Google Drive backup; keep your original cards because backup is optional and not continuous sync. Temporary Share content expires after 30 minutes or earlier when revoked and is never included in wallet backup.

Support

If you email us, we receive your email address and the message or attachments you choose to send so we can respond. Do not send real membership numbers or card images unless needed for your support request. We do not sell your card collection.

Changes

We will update this policy when the app's data practices change and publish the new effective date.